how to store passwd in shell scripts

[David Greenberg_3]

I need to create some shell scripts that will have FTP username and password info. I know this is not secure, but I dont know what alternatives there are for me. I'm ready to explain the security risks to my users, but want to have some options besides:
1. "You have to type the passwd each time you run the script", and 2.
"The password is in a world readable file, say goodbye to all security."

Do I have any other options?

TIA

[G. Vrijhoeven]

Hi Tia,

The alternative is called scp.
check:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=350906

Gideon

[Sanjay Kumar Suri]

Check the thread.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=350906
sks

[Vijaya Kumar_3 · Accepted solution]

To pass user names and passwords to FTP program, there is a way using .netrc file. This file should exist with file permission 600 in your home directory.
Syntax:

machine login password

When you use ftp command, this will check this file and authnticated.

Also, you can go for exchanging public keys in SCP.

-Thanks
Vijay

[Elmar P. Kolkman]

Try not to do it with passwords in scripts or .netrc files. If a user can login to the server and the file is readable... but you know the risks.

If you don't want to install additional software, you could use rcp. You don't need passwords, just the correct .rhosts file on the remote machine.

If you can install additional software, or have it already installed, install ssh and use scp or sftp. The above thread contains a configuration document in SEP's response.

[Geoff Wild]

You can use .netrc - just make sure the file is 400 and owned by root.

Rgds...Geoff

[Mic V.]

I've successfully used mail to transfer information between systems. I write a program (generally Perl) to "catch" the data on the target system and use an alias in /etc/mail/aliases:

myalias: |/usr/local/bin/myprogram

to strip the headers and do something with the data that was sent to it.

The advantages IMO are that it's audited (look at /var/adm/syslog/mail.log) and seems more reliable (it queues when a host is down instead of going into the bit bucket). A disadvantage is that by default it's plain text, but so is FTP. :)

Mic

[Elmar P. Kolkman]

Geoff, sorry to disagree, but the .netrc should not be owned by root, but by the user running ftp and be located in his/her homedirectory... And some FTP servers also request a homedirectory not writable by others.

As for the mail variant: you can use any encryption algorithm on the data transferred you like. There are no passwords in it, only the send-script and receive-script (or better, program) need to know how to en- and decrypt the data. So it might be a good solution. And if you configure the receive script as mail-filter in your aliases file, the mail is processed the moment it comes in, so you don't have to schedule and poll for new mail...

[David Greenberg_3]

Hello and Thanks for your ideas.
There were more passwords involved than I mentioned in my original message. I have decided to secure the script with SUDO.

Thank you for all your help.

[Donny Jekels]

use ssl encrytpion. or shoot your programmer.